AI Security
LLM security tools that treat model output as untrusted (2026)
A 2026 shortlist of controls for the app that calls a model. Public docs, not a lab bake-off.
Expertise: AI Security · Level: Intermediate · 12 min read
The model is a speaker, not a trusted function.
The app pasted a tool result into the next prompt. The model then called a second tool. LLM security is allowlists, output handling, and evals you own. It is not an AI SOC copilot. That list already lives under Security Operations.
Six controls. Two open rails. One eval runner. Two commercial filters. One validator framework. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| NeMo Guardrails | Open rails around the call | Apache-2.0 |
| LLM Guard | Library that scans prompt and output | MIT |
| Promptfoo | Evals you keep in git | MIT |
| Lakera | Commercial prompt firewall | Commercial |
| Azure AI Content Safety | First-party filter on Azure | Azure consumption |
| Guardrails AI | Validators around structured output | Apache-2.0 (lib) / commercial cloud |
NeMo Guardrails
Best for open rails around the call
NeMo Guardrails is NVIDIA’s open toolkit. Colang configs define what the bot may say and which tools it may call.
Key features
- Colang rails
- Input and output rails
- Tool allowlists
- Apache-2.0
Why we like it
This is the hidden gem. A rail you can read is a rail you can review. You run it on a host you own.
Limits
You still write the rail. It is not a SOC product. Model quality is a different job.
LLM Guard
Best for library that scans prompt and output
LLM Guard is a Python library of scanners: prompt injection heuristics, PII, toxicity. You call it before and after the model.
Key features
- Input and output scanners
- MIT
- Composable in an app
- Self-host
Why we like it
When the control must be a function in the request path, a library beats a new SaaS.
Limits
Heuristics miss. You still treat output as untrusted. Not a complete MCP gateway.
Promptfoo
Best for evals you keep in git
Promptfoo runs evals. Assertions live next to the prompt. You can fail CI when a rail regresses.
Key features
- YAML evals
- CI friendly
- Red-team style assertions without a cookbook
- MIT
Why we like it
A rail you never test will drift. Promptfoo is the eval file.
Limits
An eval is not runtime enforcement. You still need a rail in the app.
Lakera
Best for commercial prompt firewall
Lakera sells Guard for prompt attacks. The known shelf for teams who will not host NeMo.
Key features
- API filter
- Prompt attack categories
- Dashboard
- Commercial
Why we like it
If procurement already wrote Lakera, this is that row. The open rails still matter for the allowlist.
Limits
Commercial. We did not run a tenant. A filter is not object-level authZ on the tool.
Azure AI Content Safety
Best for first-party filter on Azure
Azure AI Content Safety is the first-party filter if the model already sits on Azure.
Key features
- Prompt and output filters
- Azure auth
- Categories Microsoft documents
- Consumption price
Why we like it
Start with the control in the same cloud as the model. Then add a rail you can grep.
Limits
Azure-shaped. Categories are Microsoft’s. Not an eval repo.
Guardrails AI
Best for validators around structured output
Guardrails wraps a call with validators. Structured output that fails a schema does not proceed.
Key features
- Validators
- Structured output
- Open lib
- Cloud option
Why we like it
When the model must return JSON your app will execute, a schema fail-closed is the job.
Limits
A schema is not a tool allowlist. Cloud is paid. You still own the validator set.
What the internet thinks about LLM security tools
HN still lands on untrusted output. We will not publish a jailbreak recipe from those threads.
conception on Hacker News, Jul 2026: “You should assume your models are constantly being attacked by various forms of prompt injection.”
Prove NeMo still has a tree
Confirm NeMo Guardrails still publishes. Do not point a rail at a production tool with write access on the first run.
curl -fsSIL https://github.com/NVIDIA-NeMo/Guardrails | head -n 8FAQs
Is this the AI SOC list?
No. AI SOC is a copilot on the queue. This page is the app that calls a model.
Does a filter replace tool allowlists?
No. A toxicity filter is the wrong door for a payment tool. Allowlist the function.
Can I skip evals if I bought Lakera?
No. A vendor filter does not prove your rail still holds after a prompt change.
Is this a scored bake-off?
No. Order is editorial. We do not publish jailbreak recipes.
